5 files changed, 62 insertions, 8 deletions
diff --git a/pkg/sentry/platform/ptrace/BUILD b/pkg/sentry/platform/ptrace/BUILD
index 6a1343f47..1b6c54e96 100644
--- a/pkg/sentry/platform/ptrace/BUILD
+++ b/pkg/sentry/platform/ptrace/BUILD
@@ -5,6 +5,7 @@ package(licenses = ["notice"])
 go_library(
     name = "ptrace",
     srcs = [
+        "filters.go",
         "ptrace.go",
         "ptrace_unsafe.go",
         "stub_amd64.s",
diff --git a/pkg/sentry/platform/ptrace/filters.go b/pkg/sentry/platform/ptrace/filters.go
new file mode 100644
index 000000000..1e07cfd0d
--- /dev/null
+++ b/pkg/sentry/platform/ptrace/filters.go
@@ -0,0 +1,33 @@
+// Copyright 2019 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ptrace
+
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/seccomp"
+)
+
+// SyscallFilters returns syscalls made exclusively by the ptrace platform.
+func (*PTrace) SyscallFilters() seccomp.SyscallRules {
+	return seccomp.SyscallRules{
+		unix.SYS_GETCPU:            {},
+		unix.SYS_SCHED_SETAFFINITY: {},
+		syscall.SYS_PTRACE:         {},
+		syscall.SYS_TGKILL:         {},
+		syscall.SYS_WAIT4:          {},
+	}
+}
diff --git a/pkg/sentry/platform/ptrace/ptrace.go b/pkg/sentry/platform/ptrace/ptrace.go
index ee7e0640c..6fd30ed25 100644
--- a/pkg/sentry/platform/ptrace/ptrace.go
+++ b/pkg/sentry/platform/ptrace/ptrace.go
@@ -45,6 +45,7 @@
 package ptrace
 
 import (
+	"os"
 	"sync"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
@@ -236,3 +237,17 @@ func (p *PTrace) NewAddressSpace(_ interface{}) (platform.AddressSpace, <-chan s
 func (*PTrace) NewContext() platform.Context {
 	return &context{}
 }
+
+type constructor struct{}
+
+func (*constructor) New(*os.File) (platform.Platform, error) {
+	return New()
+}
+
+func (*constructor) OpenDevice() (*os.File, error) {
+	return nil, nil
+}
+
+func init() {
+	platform.Register("ptrace", &constructor{})
+}
diff --git a/pkg/sentry/platform/ptrace/subprocess.go b/pkg/sentry/platform/ptrace/subprocess.go
index f15b3415a..15e84735e 100644
--- a/pkg/sentry/platform/ptrace/subprocess.go
+++ b/pkg/sentry/platform/ptrace/subprocess.go
@@ -123,7 +123,7 @@ type subprocess struct {
 	contexts map[*context]struct{}
 }
 
-// newSubprocess returns a useable subprocess.
+// newSubprocess returns a usable subprocess.
 //
 // This will either be a newly created subprocess, or one from the global pool.
 // The create function will be called in the latter case, which is guaranteed
@@ -155,6 +155,7 @@ func newSubprocess(create func() (*thread, error)) (*subprocess, error) {
 			errChan <- err
 			return
 		}
+		firstThread.grabInitRegs()
 
 		// Ready to handle requests.
 		errChan <- nil
@@ -179,6 +180,7 @@ func newSubprocess(create func() (*thread, error)) (*subprocess, error) {
 
 			// Detach the thread.
 			t.detach()
+			t.initRegs = firstThread.initRegs
 
 			// Return the thread.
 			r <- t
@@ -253,7 +255,7 @@ func (s *subprocess) newThread() *thread {
 	return t
 }
 
-// attach attachs to the thread.
+// attach attaches to the thread.
 func (t *thread) attach() {
 	if _, _, errno := syscall.RawSyscall(syscall.SYS_PTRACE, syscall.PTRACE_ATTACH, uintptr(t.tid), 0); errno != 0 {
 		panic(fmt.Sprintf("unable to attach: %v", errno))
@@ -269,7 +271,9 @@ func (t *thread) attach() {
 
 	// Initialize options.
 	t.init()
+}
 
+func (t *thread) grabInitRegs() {
 	// Grab registers.
 	//
 	// Note that we adjust the current register RIP value to be just before
@@ -281,9 +285,9 @@ func (t *thread) attach() {
 	t.initRegs.Rip -= initRegsRipAdjustment
 }
 
-// detach detachs from the thread.
+// detach detaches from the thread.
 //
-// Because the SIGSTOP is not supressed, the thread will enter group-stop.
+// Because the SIGSTOP is not suppressed, the thread will enter group-stop.
 func (t *thread) detach() {
 	if _, _, errno := syscall.RawSyscall6(syscall.SYS_PTRACE, syscall.PTRACE_DETACH, uintptr(t.tid), 0, uintptr(syscall.SIGSTOP), 0, 0); errno != 0 {
 		panic(fmt.Sprintf("can't detach new clone: %v", errno))
@@ -370,7 +374,7 @@ func (t *thread) destroy() {
 
 // init initializes trace options.
 func (t *thread) init() {
-	// Set our TRACESYSGOOD option to differeniate real SIGTRAP. We also
+	// Set the TRACESYSGOOD option to differentiate real SIGTRAP.
 	// set PTRACE_O_EXITKILL to ensure that the unexpected exit of the
 	// sentry will immediately kill the associated stubs.
 	const PTRACE_O_EXITKILL = 0x100000
@@ -554,7 +558,7 @@ func (s *subprocess) switchToApp(c *context, ac arch.Context) bool {
 		if c.signalInfo.Code > 0 {
 			// The signal was generated by the kernel. We inspect
 			// the signal information, and may patch it in order to
-			// faciliate vsyscall emulation. See patchSignalInfo.
+			// facilitate vsyscall emulation. See patchSignalInfo.
 			patchSignalInfo(regs, &c.signalInfo)
 			return false
 		} else if c.signalInfo.Code <= 0 && c.signalInfo.Pid() == int32(os.Getpid()) {
diff --git a/pkg/sentry/platform/ptrace/subprocess_linux.go b/pkg/sentry/platform/ptrace/subprocess_linux.go
index 84d4cf0bd..87ded0bbd 100644
--- a/pkg/sentry/platform/ptrace/subprocess_linux.go
+++ b/pkg/sentry/platform/ptrace/subprocess_linux.go
@@ -235,6 +235,7 @@ func attachedThread(flags uintptr, defaultAction linux.BPFAction) (*thread, erro
 			return nil, fmt.Errorf("wait failed: expected SIGSTOP, got %v", sig)
 		}
 		t.attach()
+		t.grabInitRegs()
 
 		return t, nil
 	}
@@ -305,7 +306,7 @@ func (s *subprocess) createStub() (*thread, error) {
 		arch.SyscallArgument{Value: 0},
 		arch.SyscallArgument{Value: 0})
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("creating stub process: %v", err)
 	}
 
 	// Wait for child to enter group-stop, so we don't stop its
@@ -324,7 +325,7 @@ func (s *subprocess) createStub() (*thread, error) {
 		arch.SyscallArgument{Value: 0},
 		arch.SyscallArgument{Value: 0})
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("waiting on stub process: %v", err)
 	}
 
 	childT := &thread{